CVE-2026-11407 is a high-severity vulnerability in Pimcore CMS/DXP version 12.3.8 involving improper neutralization of special elements used in the Twig template engine. The custom Twig SecurityPolicy's empty implementations of checkMethodAllowed() and checkPropertyAllowed() allow authenticated admin users to bypass sandbox restrictions. Attackers can supply malicious Twig templates through the DataObject ClassDefinition Layout\Text component to invoke arbitrary PHP object methods, enabling arbitrary file reads, database query execution, and potential remote code execution via PHP object gadget chains. The presence of a pimcore_* function wildcard further broadens the bypass to all Pimcore Twig functions, increasing the attack surface.

An authenticated administrative attacker can exploit this vulnerability to execute arbitrary PHP methods, leading to unauthorized file reads, execution of arbitrary database queries, and potentially remote code execution. This compromises the confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrative access to trusted users only and monitor for suspicious activity involving Twig templates. Avoid deploying untrusted Twig templates in the DataObject ClassDefinition Layout\Text component.